You have just come from your Chief Information Security Officer's (CISO) office with the instructions to provide an audit report of all AWS network rules used by the organization's Amazon EC2 instances. You have discovered that a single Describe-Security-Groups API call will return all of an account's security groups and rules within a region. You create the following pseudo-code to create the required report:
- Parse "aws ec2 describe-security-groups" output
- For each security group
- Create report of ingress and egress rules
Which two additional pieces of logic should you include to meet the CISO's requirements? (Choose two.)

Question

You have just come from your Chief Information Security Officer's (CISO) office with the instructions to provide an audit report of all AWS network rules used by the organization's Amazon EC2 instances. You have discovered that a single Describe-Security-Groups API call will return all of an account's security groups and rules within a region. You create the following pseudo-code to create the required report:

- Parse "aws ec2 describe-security-groups" output

- For each security group

- Create report of ingress and egress rules

Which two additional pieces of logic should you include to meet the CISO's requirements? (Choose two.)

Michal Kopl · Accepted Answer

Parse security groups in each region.

Michal Kopl · Accepted Answer

Evaluate VPC network access control lists.

Michal Kopl · Answer

Parse security groups in each Availability Zone and region.

Michal Kopl · Answer

Evaluate AWS CloudTrail logs.

Michal Kopl · Answer

Evaluate Elastic Load Balancing access control lists.

Michal Kopl · Answer

Parse CloudFront access control lists.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 432 - DOP-C01 discussion

Suggested answer: A, C

0 comments